Security system with extraction, reconstruction and secure recovery and storage of data

• US 8,677,505 B2
• Filed: 09/06/2007
• Issued: 03/18/2014
• Est. Priority Date: 11/13/2000
• Status: Active Grant

• Current Assignee: DigitalDoors, Inc.
• Original Assignee: DigitalDoors, Inc.
• Inventors: Redlich, Ron M., Nemzow, Martin A.
• Primary Examiner(s): PYZOCHA, MICHAEL J
• Application Number:
  US11/829,207
• Publication Number:
  US 20080222734A1
• Time in Patent Office: 2,385 Days
• Field of Search: 726/27, 713/166, 713/193, 715/255
• US Class Current: 726/27
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 2209/04 Masking or blinding
• CPC Class Codes: H04L 2209/16 Obfuscation or hiding, e.g. involving white box
• CPC Class Codes: H04L 2209/42 Anonymization, e.g. involving pseudonyms
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/002 Countermeasures against attacks on cryptographic mechanisms network architectures or network communication protocols for protection against malicious traffic H04L63/1441
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

The method for securing data includes establishing a group of security sensitive items, filtering data and extracting and separating the security items from remainder data. The filtered data are separately stored (locally on a PC or on another computer in a LAN or WAN or on the Internet.) A map may be generated. The filter and/or map may be destroyed or stored. The data input, extracted data and remainder data may be deleted from the originating computer. Encryption may be utilized to enhance security (including transfers of data, filter and map). Reconstruction of the data is permitted only in the presence of a predetermined security clearance. A plurality of security clearances may be used to enable a corresponding plurality of partial, reconstructed views of the plaintext (omitting higher security words).

Claims

1. A computerized method of securing data in a plurality of security controlled data stores with access controls thereat, said data potentially having sensitive content such as sensitive words, data objects, characters, images, data elements or icons, comprising:

storing separately sensitive content in secure data stores of said plurality of security data stores, wherein said security data stores are selected in a predetermined manner by random selection, and wherein each said secure data store has a unique access control;

permitting reconstruction of some or all of said data by a requesting party with appropriate access controls applied to respective secure data stores;

the permitted reconstruction limited by (i) the requesting party'"'"'s permitted login day-and-time permissions;

(ii) the requesting party'"'"'s permitted login time allocation for said respective secure data store;

(iii) the requesting party'"'"'s location; and

(iv) the requesting party'"'"'s audit process results; and

auditing the requesting party'"'"'s access to said respective secure data stores for a predetermined threat pattern based upon the requesting party'"'"'s access rights, permitted login day-and-time permissions, login time allocation, the requesting party'"'"'s location and generating the requesting party'"'"'s audit process results.

2. A computerized method of securing data as claimed in claim 1 wherein said storing includes at least one or both of filtering or extracting said sensitive content in said secure data stores.

3. A computerized method of securing data as claimed in claim 1 wherein said storing includes at least one or both of removing or copying said sensitive content in said secure data stores.

4. A computerized method of securing data as claimed in claim 1 wherein said storing includes at least one or both of translating said sensitive content in said secure data stores or transforming said sensitive content in said secure data stores.

5. A computerized method of securing data as claimed in claim 1 wherein said storing includes at least one or both of filtering and transferring or extracting and transferring said sensitive content in said secure data stores.

6. A computerized method of securing data as claimed in claim 1 wherein said storing includes at least one or both of transforming or converting said sensitive content in said secure data stores.

7. A computerized method of securing data as claimed in claim 1 wherein said storing includes at least one or more of rendering, archiving and transposing said sensitive content in said secure data stores.

8. A computerized method of securing data as claimed in claim 1 wherein said storing of said sensitive content in said secure data stores includes at least one or both of partially or completely storing said sensitive content in said secure data stores.

9. A computerized method of securing data as claimed in claim 1 wherein said storing of said sensitive content in said secure data stores includes partially or completely storing said sensitive content in said secure data stores with at least one of encryption, data compression, or with parsed transmission of data.

10. A computerized method of securing data as claimed in claim 1 wherein said storing of said sensitive content in said secure data stores includes at least one or more of labeling, or classifying said sensitive content in said secure data stores.

11. A computerized method of securing data as claimed in claim 1 including automatically at least one of:

tagging prior to storing and, at least one or more of labeling, or classifying said sensitive content in said secure data stores;

or

tagging concurrent with storing and, at least one or more of labeling, or classifying said sensitive content in said secure data stores.

12. A computerized method of securing data as claimed in claim 1 including at least one of:

tagging prior to storing and, at least one or more of labeling, or classifying said sensitive content in said secure data stores;

or

tagging concurrent with storing and, at least one or more of labeling, or classifying said sensitive content in said secure data stores; and

wherein

said sensitive content has different levels of sensitive content therein corresponding to respective ones of said secure data stores.

13. A computerized method of securing data as claimed in claim 1 wherein said sensitive content is defined as at least one of security sensitive content, content of significance, trade secret content, personal identifying information, content subject to regulatory provisions, or back-up content and said respective ones of said secure data stores are correspondingly designated as at least one of security sensitive stores, stores for content of significance, trade secret stores, personal identifying information stores, regulatory provision stores, or back-up stores.

14. A computerized method of securing data as claimed in claim 1 wherein said sensitive content is defined as at least one of litigation specific content, aged content, archival content, historical content and said respective ones of said secure data stores are correspondingly designated as at least one of litigation specific stores, aged content stores, archival stores, or historical content stores.

15. A computerized method of securing data as claimed in claim 1 wherein said storing of sensitive content in said secure data stores includes storing data in said security data stores in a predetermined manner with an algorithmic random selection for said data stores.

16. A computerized method of securing data as claimed in claim 1 wherein said storing of sensitive content in said secure data stores includes storing data in optical media data stores.

17. A computerized method of securing data as claimed in claim 1 wherein said storing sensitive content in said secure data stores includes storing data in at least one of non-magnetic media stores or print stores.

18. A computerized method of securing data as claimed in claim 1 wherein storing of said sensitive content is done separately with respect to at least one of remainder data, left-over data, non-sensitive content data, surplus data, residue data, remnant data, or data complementary to sensitive content data.

19. A computerized method of securing data as claimed in claim 1 wherein permitting reconstruction includes at least one of reassembly, reconstitution, regeneration, compilation, reorganization, reclamation or reformation of some or all of said data with appropriate access controls applied to respective secure data stores.